MODULE 03 · Vulnerability Intelligence

11,000 new CVEs this quarter. You can patch 40. Which 40?

Cvekit merges EPSS probability, CISA KEV membership, exploit maturity and ransomware linkage into a single view of real-world pressure, over a record that also carries CVSS v3.1 and v4.0 vectors, affected-version matrices, weakness chains, exploit provenance and threat-actor attribution.

01Capabilities

What Cvekit sees

One page, four signals

EPSS probability and its percentile, KEV status, public exploit maturity and ransomware campaign linkage on a single CVE page, each with its history, so you read the trend rather than today's number alone. Severity tells you what could hurt; these tell you what is hurting.

ATT&CK-mapped, advisory-chained

Every CVE links to its ATT&CK techniques, carrying the confidence and the written rationale behind each mapping, plus its CWE-to-CAPEC weakness chain and the vendor advisory graph with fixed versions and workarounds. The patch decision meets your detection strategy on one page.

Affected products, and the fix

Match by product and version range (CPE) or by package (PURL, covering npm, PyPI, Maven and the rest), each pinned to the versions that close it. "Is this one ours, and what do we upgrade to" becomes a single lookup instead of an afternoon.

The neighbourhood around a CVE

From one record you can pivot to the CVEs that share its weakness class, the ones attributed to the same threat actor, and the ones affecting the same vendor and product. A single finding turns into the cluster it belongs to.

Severity is not likelihood

Why CVSS alone sends you patching the wrong things

Typical CVEs hug the floor at every severity. Put EPSS on the y-axis and the ones that burn separate instantly. Each named CVE is listed under the plot with its current scores, and links to its live record on cvekit.com.

CVSS × EPSS

sample

96.0%

of the 32,771 CVEs rated CVSS 9.0 and above carry an EPSS below 5%: rated critical, forecast never to be exploited.

Scatter plot of CVSS severity against EPSS exploitation probability. Mark size and brightness show how many CVEs fall in each band: the mass sits in the lowest probability band at every severity, and thins to almost nothing above it. Beside the plot, the share of the corpus in each probability band: 75 to 100 percent, 0.1%. 50 to 75 percent, 0.2%. 25 to 50 percent, 0.6%. 10 to 25 percent, 1.2%. 5 to 10 percent, 0.8%. 0 to 5 percent, 96.8%. The named CVEs sit alone in the top right corner, above 88% probability, and are listed with their scores, as links, below the plot.

  • 75 to 100%0.1%
  • 50 to 75%0.2%
  • 25 to 50%0.6%
  • 10 to 25%1.2%
  • 5 to 10%0.8%
  • 0 to 5%96.8%
  • 75 to 100%0.1%
  • 50 to 75%0.2%
  • 25 to 50%0.6%
  • 10 to 25%1.2%
  • 5 to 10%0.8%
  • 0 to 5%96.8%
NAMED CVE CORPUS DENSITY (sample) · SIZE = CVE COUNT

X · CVSS SEVERITY / Y · EPSS 30-DAY EXPLOITATION PROBABILITY / SHARE OF CORPUS PER BAND

The tempo and the split

The corpus, in motion

Twelve months of publication volume, and where the corpus lands on the severity scale, with the KEV and public-exploit overlays that mark actual risk. Live from the same index cvekit.com serves.

CVE PULSE

sample
CVE PUBLICATIONS / MONTHTRAILING 12M
4.4K

SEVERITY DISTRIBUTION

1.4K on CISA KEV · 8.2K with a public exploit

LOW 38.0K MEDIUM 148K HIGH 122K CRITICAL 59.0K

ILLUSTRATIVE SAMPLE · THE LIVE SERIES REPLACES THIS

FIGURES FLOORED · NEVER ROUNDED UP

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/cvekit/v1/cves/{cve_id}

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/cvekit/v1/cves/CVE-2024-3400\
?include_history=true&include_intel=true"

RESPONSE · 200

{
  "cve_id": "CVE-2024-3400",
  "published_at": "2024-04-12T08:15:06Z",
  "cvss_v31_score": 10.0,
  "cvss_v31_severity": "critical",
  "cvss_v40_score": 10.0,
  "epss_score": 0.943,
  "epss_percentile": 0.999,
  "is_kev": true,
  "kev_added_at": "2024-04-12T00:00:00Z",
  "has_exploit": true,
  "exploit_maturity_max": "weaponized",
  "has_ransomware_link": true,
  "weaknesses": [
    { "source": "nvd", "cwe_id": "CWE-77", "type": "Primary", "capec_ids": ["CAPEC-248"] }
  ],
  "cpe_matches": [
    { "source": "nvd", "cpe_vendor": "paloaltonetworks", "cpe_product": "pan-os",
      "vulnerable": true, "version_start_including": "10.2.0" }
  ],
  "exploits": [
    { "source": "exploitdb", "maturity": "weaponized", "published_at": "2024-04-16T00:00:00Z" }
  ],
  "attack_techniques": [
    { "technique_id": "T1190", "technique_name": "Exploit Public-Facing Application",
      "confidence": "high", "rationale": "Unauthenticated command injection on the mgmt interface." }
  ],
  "vendor_advisories": [
    { "vendor": "paloaltonetworks", "fixed_versions": ["10.2.9-h1"], "workaround": "Disable device telemetry." }
  ],
  "epss_history": [{ "scored_at": "2024-04-13", "score": 0.943, "percentile": 0.999 }]
}

include_history adds the full EPSS time series; include_intel adds the related-CVE lists by weakness, actor and product.

Public index, platform depth

The public library lives at cvekit.com: every CVE on a permanent page with EPSS, KEV and exploit status, free and with no account. The full ATT&CK chains and their rationale, the advisory graph, threat-actor attribution, related-CVE pivots and programmatic access through this API live in the platform.

Full API reference ships with your workspace: every endpoint, versioned.

03In practice

From feed panic to patch plan

Mon 09:00

A new edge-device CVE trends on social feeds. CVSS 9.8, as were 400 others this year.

Mon 09:04

Cvekit shows EPSS at 0.31 and climbing, no KEV yet, PoC published overnight.

Tue 14:20

The record moves: EPSS crosses 0.80, exploit maturity flips to weaponized, and CISA adds it to KEV.

Tue 15:00

You move the patch from "next cycle" to "this week", with the score history attached to the change ticket.

Questions

Cvekit, honestly answered

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

NDA-friendly briefings · global coverage · no slideware